Alibabacloud Ehpc Instant Job Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 0.0.1

Overview

The skill appears aimed at Alibaba Cloud E-HPC job management, but it also gives the agent broad cloud administration authority and persistent CLI configuration changes beyond that narrow purpose.

Install only if you intend to let the agent administer Alibaba Cloud resources, not just submit jobs. Use a test account or tightly scoped RAM role, avoid the provided broad/full-access policies for production, pin or separately approve CLI/plugin updates, and require explicit review before any create, delete, image, NAS, VPC, vSwitch, or access-rule action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Mandatory Unpinned Alibaba Cloud CLI Plugin Installation and Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-43
Vulnerability Type: Mutable, unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown

- [MUST] Run `aliyun configure set --auto-plugin-install true` to enable automatic plugin installation.
- [MUST] Run `aliyun plugin update` to ensure installed plugins are always current.
...
> aliyun configure ai-mode enable
> aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-ehpc-instant-job-skill"
> aliyun plugin update

Technical Analysis

The Skill mandates enabling automatic plugin installation and running an unconditional plugin update. No plugin version is pinned, and the workflow does not independently verify a package signature, digest, or allowlisted artifact before installation.

Consequently, the locally executed plugin code may differ from the code present when the Skill was audited. This creates a mutable supply-chain execution path. Because the Alibaba Cloud CLI operates in a context that may have access to environment-based credentials, ~/.aliyun/config.json, or ECS RAM-role credentials, a compromised plugin or update channel could execute with the Agent user's local permissions and the configured cloud identity.

The behavior is not required on every invocation to perform the declared job-management operations. Verifying that a compatible, audited plugin is already installed would be sufficient in normal operation.

Attack Path

1. The Skill is loaded and follows its mandatory initialization instructions.
2. It enables automatic CLI plugin installation.
3. It invokes aliyun plugin update without pinning an audited version.
4. A compromised upstream artifact, repository, distribution channel, or plugin release supplies malicious plugin code.
5. The Alibaba Cloud CLI installs or executes that mutable code locally.
6. The plugin inherits the process's ...[truncated 775 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to enable automatic plugin installation on every run.
2. Pin the required plugin to a specific, reviewed version.
3. Verify the downloaded artifact using a publisher signature or a trusted, pinned cryptographic digest.
4. Use an explicit allowlist for plugin names, versions, and distribution endpoints.
5. Check for an already installed compatible plugin before attempting installation.
6. Treat installation and updates as separate administrative operations requiring explicit user confirmation.
7. Run plugin installation in a restricted environment without production credentials.
8. Document a tested rollback procedure and retain the last known-good plugin artifact.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/ram-policies.md:40

Finding

Overbroad IAM Policy Presented as Minimum Privilege

Content

View full analysis

Vulnerability Details

File Location: references/ram-policies.md, lines 40-108
Vulnerability Type: Excessive cloud permissions and wildcard resource scope
Risk Level: Medium

Complete Code Snippet:

json

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ehpc:AddImage",
        "ehpc:CreateJob",
        "ehpc:CreateImageByExecutor",
        "ehpc:DeleteJobs",
        "ehpc:DeleteJobRecords",
        "ehpc:DescribeJobMetricData",
        "ehpc:DescribeJobMetricLast",
        "ehpc:DescribeJobResults",
        "ehpc:GetAppVersions",
        "ehpc:GetImage",
        "ehpc:GetJob",
        "ehpc:GetLoginUrlForExecutor",
        "ehpc:GetGlobalResourceLast",
        "ehpc:GetGlobalResourceStatistic",
        "ehpc:ListImages",
        "ehpc:ListJobExecutors",
        "ehpc:ListJobs",
        "ehpc:RemoveImage",
        "ehpc:SynchronizeApp",
        "ehpc:ListRegions",
        "ehpc:ListAvailableFileSystems"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeImages",
        "ecs:DescribeSecurityGroups",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:DescribeEipAddresses"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "tag:ListTagKeys",
        "tag:ListTagValues"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cms:QueryMetricList",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "oss:ListBuckets",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:GetRole",
      "Resource": "*"
    }
  ]
}

Technical Analysis

The policy described as suitable when “only instant job functionality” is required grants capabilities beyond the d ...[truncated 2273 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the single broad policy with operation-specific policies:
   • Read-only: ListJobs, GetJob, and required result/log APIs.
   • Creation: CreateJob plus only necessary resource-discovery APIs.
   • Deletion: DeleteJobs only when deletion is requested.
2. Remove CreateImageByExecutor, DeleteJobRecords, GetLoginUrlForExecutor, RemoveImage, SynchronizeApp, oss:ListBuckets, and ram:GetRole from the baseline policy.
3. Place optional image-management, executor-access, monitoring, and application-management permissions in separate policies that require explicit enablement.
4. Scope permissions to specific resources, regions, projects, tags, or conditions wherever Alibaba Cloud RAM supports resource-level authorization.
5. Prefer short-lived STS credentials or ECS RAM roles over long-lived AccessKeys.
6. Apply explicit deny or permission-boundary controls for unrelated services and destructive operations.
7. Audit the effective policy with Alibaba Cloud access-analysis and action-usage data, then remove permissions not exercised by the declared workflow.
8. Do not recommend AliyunEHPCFullAccess for routine production use except as a temporary diagnostic measure with explicit warnings and prompt revocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The reference document exposes capabilities well beyond the skill’s stated job-management purpose, including image, pool, action plan, tagging, monitoring, executor, and application-management operations. This expands the effective authority and action surface of the skill, increasing the chance that an agent or user will invoke unrelated privileged operations that were not justified or safety-reviewed for this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file documents image-management actions (AddImage, GetImage, ListImages, RemoveImage) inside a skill whose declared purpose is job management. That scope expansion is dangerous because it gives an agent access to higher-impact resource-administration operations than users may expect, including destructive removal of images and registration of untrusted VM/container images that could later be used to run workloads.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recommending the system policy AliyunEHPCFullAccess materially exceeds the documented job-management scope and normalizes granting broad administrative access. If adopted, this can allow far more EHPC actions than needed, increasing the chance of destructive changes, unauthorized resource creation, or privilege abuse through the skill's credentials.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file materially expands the skill from EHPC Instant job management into full NAS administration, including create, modify, and delete operations for storage resources. In an agent context, this scope drift is dangerous because it can cause the agent to perform privileged infrastructure changes unrelated to the user's expected task boundary, increasing the chance of destructive or unauthorized actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These sections document privileged NAS lifecycle actions such as filesystem creation, mount-target management, updates, and deletion, none of which are necessary for a job-management-only skill. If an agent follows this guidance, it may provision billable resources, alter networking, or delete storage containing user data, creating confidentiality, integrity, availability, and cost risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The access-group and access-rule examples extend the skill into storage and network security administration by changing who can mount NAS resources and from where. Misuse of these commands could expose data to overly broad CIDR ranges or weaken access controls, making the out-of-scope expansion especially sensitive.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file substantially exceeds the stated skill scope of E-HPC Instant job management by providing end-to-end VPC and vSwitch administration guidance, including create, modify, and delete operations. In an agent-skill context, this expands the operational blast radius from job orchestration into network-infrastructure control, increasing the chance an agent could be induced to perform destructive or unauthorized changes unrelated to the user’s original task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented capabilities include creating VPCs, modifying vSwitch attributes, enabling IPv6, and deleting vSwitches, which are privileged network-administration actions not justified by the skill’s declared purpose. If an agent were allowed to rely on this guidance, prompt injection or user confusion could steer it into reconfiguring cloud networking, causing outages, exposure changes, or resource deletion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope or permission boundary, yet it instructs reading local files and mutating CLI configuration, which implies access to environment state and host configuration. Without an allowlist such as permissions or allowed-tools, an agent may execute broader filesystem or environment interactions than the user expects, increasing the chance of unintended data exposure or unsafe actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a job-management skill, but the body expands this into full lifecycle management of compute resources. This scope expansion can mislead users and orchestrators about what the skill may do, causing overbroad trust and enabling actions beyond the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions go beyond job management and direct the agent to alter local and global execution environment state, including CLI configuration, plugin state, and AI-mode settings. Environment mutation that is not clearly disclosed creates persistence risks, can affect unrelated future sessions, and may change how subsequent commands behave across the system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates aliyun configure set --auto-plugin-install true, aliyun plugin update, and AI-mode toggling, all of which modify global CLI behavior beyond the core need of managing E-HPC jobs. This is dangerous because it enables network-retrieved plugin changes and persistent client reconfiguration, which can introduce supply-chain risk, telemetry/identity side effects, and unintended impact on other workflows using the same host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

### 官方文档
- 阿里云E-HPC Instant产品文档：https://help.aliyun.com/product/ehpcinstant.html
- E-HPC Instant API文档：https://api.aliyun.com/document/EhpcInstant/2023-07-01/overview
- 阿里云CLI官方文档：https://help.aliyun.com/document_detail/121529.html

## 安全策略与风险控制

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/ehpcinstant.md (reported line 587)May include surrounding context.

md

### 官方文档
- 阿里云E-HPC Instant产品文档：https://help.aliyun.com/product/ehpcinstant.html
- E-HPC Instant API文档：https://api.aliyun.com/document/EhpcInstant/2023-07-01/overview
- 阿里云CLI官方文档：https://help.aliyun.com/document_detail/121529.html

## 安全策略与风险控制

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/storage.md (reported line 308)May include surrounding context.

md

### 官方文档
- 阿里云E-HPC Instant产品文档：https://help.aliyun.com/product/ehpcinstant.html
- E-HPC Instant API文档：https://api.aliyun.com/document/EhpcInstant/2023-07-01/overview
- 阿里云CLI官方文档：https://help.aliyun.com/document_detail/121529.html

## 安全策略与风险控制

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/vswitch.md (reported line 341)May include surrounding context.

md

### 官方文档
- 阿里云E-HPC Instant产品文档：https://help.aliyun.com/product/ehpcinstant.html
- E-HPC Instant API文档：https://api.aliyun.com/document/EhpcInstant/2023-07-01/overview
- 阿里云CLI官方文档：https://help.aliyun.com/document_detail/121529.html

## 安全策略与风险控制

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/aliyun-cli.md (reported line 22)May include surrounding context.

md

# 3. 解压并安装
tar xzf /tmp/aliyun-cli.tgz -C /tmp
sudo mv /tmp/aliyun /usr/local/bin/

# 4. 验证安装
aliyun version

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide instructs users to enter long-lived AccessKey credentials directly into the CLI without any warning about secure handling, least privilege, rotation, or avoiding credential exposure in shared environments. In an agent skill context, this increases the chance that users paste sensitive cloud secrets into systems, terminals, or logs where they may be retained or leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document provides destructive deletion examples for jobs without any warning, confirmation guidance, or discussion of irreversible effects; the same pattern is repeated elsewhere for other resource types. In an agent skill context, omission of safety prompts makes accidental or overbroad destructive actions more likely, especially if a user request is ambiguous or automated workflows reuse these examples.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Application synchronization is not aligned with the skill’s stated purpose of managing E-HPC Instant jobs. Including cross-region app synchronization introduces a separate administrative capability that could be misused to replicate artifacts across regions, causing unintended propagation or policy violations outside the expected job workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch deletion script automatically enumerates succeeded jobs and deletes them without an approval checkpoint, preview, or retention safeguards. In practice this can lead to unintended bulk resource loss, loss of logs or forensic context, and operational disruption if completed jobs were still needed for auditing or downstream processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all operational and security guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as a job-management tool, but the documented RAM permissions also include image-management actions such as AddImage, CreateImageByExecutor, and RemoveImage. These extra write capabilities expand the blast radius beyond the declared use case and can let a compromised or misused skill alter runtime images, potentially introducing persistence or unauthorized code execution paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The policy includes cross-service discovery permissions for ECS, VPC, tags, OSS, CMS, and RAM that are not clearly declared in the skill description. Even if many are read-only, they enable environment enumeration and metadata harvesting, which can aid lateral movement, targeting, or sensitive infrastructure mapping if the skill or its credentials are abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all instructions and operational guidance only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.